Mac scareware gang evades Apple's new anti-malware defenses

Computerworld - The gang responsible for a month-long plague of fake Mac security software has already updated their "scareware" to evade defenses Apple put in place late Tuesday, a security company confirmed today.

"Apple's [antivirus] did not detect the new sample," said Peter James, a spokesman for Intego, a French firm that develops Mac security software.

According to James, the new malware file is identified as "mdinstall.pkg" and if installed, plants the phony MacGuard software on the victim's Mac.

Intego confirmed what ZDNet blogger Ed Bott reported earlier Wednesday, that the scammers had created a new version that wasn't detected by Apple's new defenses.

"This isn't surprising, that there's a new variant out almost as soon as Apple released its security update Tuesday," said James. "[The attackers] are following the news, they're efficient."

On Tuesday, Apple released an update for Mac OS X 10.6, aka Snow Leopard, that warns users that they've downloaded fake Mac security software and scrubs machines already infected with the scareware.

Also called "rogueware," scareware is bogus security software that claims a computer is heavily infected with worms, viruses and other malware. Once installed, the worthless program nags users with pervasive pop-ups and fake alerts until they fork over a fee. MacDefender, the generic name for the new series that targets Macs, demands $60 to $80 to cease and desist.

Intego first reported MacDefender in early May, but since then several variants have appeared, including MacGuard, which installs without requiring a password.

The new MacDefender appeared only hours after Apple issued its update yesterday, said James.

"They'll keep doing this," James predicted, referring to the cat-and-mouse game between the hackers who create MacDefender and Apple's efforts to block them.

"It's worked well enough that they're making money off it, or they wouldn't be doing this. Coming out with a new version right after the update, and a new version as soon as Apple announced it was going to release an update, shows that they're planning on staying on top of things," James said.

The move would not have surprised another researcher.

In a Tuesday interview, Chet Wisniewski, a security researcher with U.K.-based Sophos said Apple's update would either accelerate the race or the hackers would give up.

"If they keep doing [MacDefender], it implies they are succeeding at making money," said Wisniewski. "If Apple is able to stymie [MacDefender] 90% of the time or better, does that mean the bad guys will give up or up the ante?"

It seems that they've done the latter, which in James' eyes, wasn't that difficult.

"Apple's defense is signature-based," said James, talking about the antivirus tactic that relies on individual "fingerprints" of each piece of malware for detection. "Part of the new variant's code is the same, but part of it is different."